iQ Cookie State Law Series
Cookie & Privacy Law in Alabama
Educational purposes only — not legal advice. This guide is intended to help you understand the basics of Alabama’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Alabama passed its first comprehensive consumer privacy law in April 2026. Called the Alabama Personal Data Protection Act (APDPA), it largely follows the Virginia model that has become the go-to template for US state privacy laws — but with a few notable twists that set it apart. The law does not take effect until May 1, 2027, so businesses have time to prepare, but the clock is ticking.
Alabama does not have a dedicated cookie law. Cookie compliance obligations flow from the APDPA itself — specifically its rules around sensitive data consent and the right to opt out of targeted advertising.
Who does it apply to?
The APDPA covers any business that operates in Alabama or targets Alabama residents with its products or services — and meets at least one of these thresholds:
Controls or processes personal data of more than 25,000 Alabama consumers per year — not counting data used solely to complete a payment transaction.
Derives more than 25% of gross revenue from the sale of personal data, regardless of how many consumers are involved.
Exemptions include GLBA-regulated financial entities, HIPAA-covered health entities, businesses with fewer than 500 employees that do not sell personal data, and data processed in purely commercial or employment contexts.
Consumer rights
Alabama residents whose data is covered by the APDPA have six core rights:
Businesses must respond within 45 days. Note: Alabama provides no right to appeal a controller’s decision — unlike most other state privacy laws.
What makes Alabama different
No Global Privacy Control (GPC) requirement. The final version of the bill removed the requirement to honor opt-out signals like GPC. It is still best practice, but Alabama businesses are not legally obligated to honor it.
No data protection assessments required. Unlike California and Colorado, Alabama does not require formal impact assessments before high-risk data processing activities.
Narrow definition of “sale.” Alabama excludes data sharing for analytics or marketing services performed on behalf of the controller — more business-friendly than California’s approach.
Permanent 45-day cure period. Alabama’s cure window has no expiration date. Businesses always get a chance to fix problems before the AG can impose penalties.
Sensitive data & children
Processing sensitive data requires opt-in consent before any collection begins. Sensitive data includes:
For children under 13, COPPA-compliant parental consent satisfies the APDPA. For ages 13–15, businesses must obtain opt-in consent before selling that person’s data or using it for targeted advertising — if they have actual knowledge of the consumer’s age.
What this means for your cookies
| Cookie type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (geolocation, biometric) | Opt-in required | Gate these behind affirmative consent before they fire. |
| Targeted advertising cookies | Opt-out required | Provide a clear "Do Not Sell or Share" mechanism. |
| GPC signal recognition | Recommended | Not legally required, but smart — other states mandate it. |
| Analytics & functional cookies | No specific requirement | Disclose in your privacy policy. Not a "sale" under AL law. |
Enforcement
The Alabama Attorney General has sole enforcement authority. The $15,000-per-violation cap is higher than most state laws, but the permanent cure period gives businesses meaningful time to fix issues before facing penalties.
Your action checklist
The effective date is May 1, 2027 — here is what to get in place before then:
Check your thresholds. Do you process data on more than 25,000 Alabama consumers, or earn 25%+ of gross revenue from data sales? If yes, you are in scope.
Audit your cookies. Identify which cookies touch sensitive data or power targeted advertising — those are the two categories with specific compliance obligations.
Update your privacy policy. It needs to clearly cover data categories collected, purposes, consumer rights, and whether data is sold or shared for targeted advertising.
Set up opt-in for sensitive data. Cookies collecting precise geolocation or biometric data must be blocked until the user affirmatively consents.
Add a targeted advertising opt-out. A “Do Not Sell or Share My Personal Information” link in your footer or banner satisfies this requirement.
Review your vendor contracts. Any processor handling Alabama resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
iQ Cookie scans your site, flags gaps, and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 1 of 25 · Next: Arkansas →